The teachPress plugin for WordPress (developed by winkm89) contains a missing or incorrect nonce check on the import.php page, creating a classic CSRF weakness (CWE‑352). An unauthenticated attacker can build a forged request that, when a site administrator clicks a link or otherwise loads the page, will delete import data. This directly undermines the integrity of the site’s educational content by allowing data removal without authorization.

All WordPress sites running any teachPress plugin version 9.0.9 or earlier are affected. These installations are produced by the developer winkm89; site administrators should verify that their plugin version is in the affected range and plan to update as a priority.

The CVSS score of 4.3 categorizes this vulnerability as moderate, while the EPSS score of less than 1 % indicates a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires a user‑interaction CSRF, meaning an attacker must entice an administrator into executing a forged request; once the request is sent, the plugin will delete its import data, disrupting educational records.